Connect Kibo via MCP

This page is for software developers. Kibo connects to external AI tools through the MCP standard.

Kibo exposes an MCP (Model Context Protocol) server: connect your client — Claude, Cursor, VS Code, Claude Code or your own agent — and manage tasks, projects, comments and dependencies without leaving your work environment.

The server exposes only the task domain. Members, billing, settings and other users' data stay out of reach, whatever credential you use.

At a glance

Endpoint	https://app.kibowork.ai/mcp
Transport	Streamable HTTP (stateless)
Authentication	API key (Authorization: Bearer kibo_sk_…) or OAuth 2.1
stdio-only clients	npm package @kibowork/mcp
AI credits	Actions via MCP do not use Kibo AI credits. Any model cost depends on the client or agent you use.

Choose how to authenticate

Client	Method
Claude apps, ChatGPT	OAuth: enter the URL and approve access from Kibo. No key to copy.
Cursor, VS Code, Claude Code, n8n, scripts	API key sent in a header.
Clients that only launch local commands (stdio)	API key through the @kibowork/mcp package.

In every case the credential acts as you: it sees only what you see in Kibo and never goes beyond your permissions, even if the permissions granted to the key are broader.

API key

1. In Kibo open My account → Integrations → API keys.
2. Give the key a name (e.g. Cursor), choose its permissions and, if you want, an expiry date.
3. Click Create key and copy the kibo_sk_… value: it is shown only once.

A key's permissions cannot be changed: to change them, create a new key and revoke the old one. Grant only the ones you need.

Permission	Code	Allows
View tasks	task.view	Read tasks, projects, statuses, comments, dependencies and images
Create tasks	task.create	Create tasks
Edit tasks	task.edit	Edit any field, move a task, manage dependencies
Update progress	task.progress	Update status and percentage of tasks assigned to you
Comment	task.comment	Write comments
Delete tasks	task.delete	Reserved: no MCP tool deletes tasks today
Approve	task.approve	Reserved: no MCP tool decides an approval today

The key always goes in a header (Authorization: Bearer kibo_sk_… or X-Api-Key: kibo_sk_…), never in the URL: a URL ends up in logs and history.

Cursor

~/.cursor/mcp.json (global) or .cursor/mcp.json in the project:

{
  "mcpServers": {
    "kibo": {
      "url": "https://app.kibowork.ai/mcp",
      "headers": { "Authorization": "Bearer kibo_sk_YOUR_KEY" }
    }
  }
}

VS Code (GitHub Copilot, Agent mode)

.vscode/mcp.json. The root key is servers, not mcpServers:

{
  "servers": {
    "kibo": {
      "type": "http",
      "url": "https://app.kibowork.ai/mcp",
      "headers": { "Authorization": "Bearer kibo_sk_YOUR_KEY" }
    }
  }
}

Claude Code

claude mcp add --transport http --scope user kibo https://app.kibowork.ai/mcp \
  --header "Authorization: Bearer kibo_sk_YOUR_KEY"

--scope user keeps the key in your personal configuration, outside the repository.

OAuth (Claude apps, ChatGPT)

1. In the client, add a custom connector with the URL https://app.kibowork.ai/mcp.
2. The client takes you to Kibo: sign in if needed, and click Connect.
3. The client receives a token limited to the permissions listed on the approval screen.

There is no client ID or secret to create: the client registers itself (dynamic registration, RFC 7591) and uses PKCE. Authorized apps appear in My account → Integrations → Connected apps, where you can disconnect them at any time.

The @kibowork/mcp stdio package

For clients that can only launch a local command. The package forwards messages to the Kibo endpoint, adding your key; it contains no tool definitions, so new tools arrive without updating it.

Example for Claude Desktop (claude_desktop_config.json; edit it with the app fully closed):

{
  "mcpServers": {
    "kibo": {
      "command": "npx",
      "args": ["-y", "@kibowork/mcp"],
      "env": {
        "KIBO_API_KEY": "kibo_sk_YOUR_KEY",
        "KIBO_BASE_URL": "https://app.kibowork.ai"
      }
    }
  }
}

Variable	Value
KIBO_API_KEY	The kibo_sk_… key
KIBO_BASE_URL	The app address. Default https://app.kibowork.ai; for an on-premise installation, the address of your instance

Tools

Tool	Permission	What it does
list_projects	task.view	Lists visible projects and their codes
list_statuses	task.view	Lists the organization's statuses
list_tasks	task.view	Lists tasks, with filters and pagination
get_task	task.view	Returns a full task, description included
list_comments	task.view	Lists a task's comments
list_dependencies	task.view	Lists the dependencies that involve a task
get_media_info	task.view	Describes an image referenced in a task (med_…)
get_media	task.view	Returns the image, so it can be viewed
create_task	task.create	Creates a task, a phase, a milestone or an approval
update_task	task.edit / task.progress	Edits the given fields; the others stay unchanged
add_comment	task.comment	Adds a comment
add_dependency	task.edit	Makes a task depend on another (fs, ss, ff, sf, lag in minutes)
remove_dependency	task.edit	Removes a dependency

Good to know

• Identifiers. A task is referenced by its code (ACME-0012), a project by its code (ACME), a person by their usr_….
• Configurable statuses. Each organization has its own statuses: call list_statuses before setting one; do not assume todo / done.
• Where a task is created. In create_task, project accepts a project code or the code of a phase or parent task. Without project the task is standalone, not tied to a project.
• Pagination. list_tasks returns 50 rows per page (up to 200, with limit) in compact form, without description. The page block tells you whether there are more: continue with offset.
• Links. Every returned task has a url field, its page in Kibo, to show to the user.
• Dates. In ISO 8601 format; for an all-day event use allDay.

Errors

Response	Cause
401	Wrong, expired or revoked key; or expired OAuth token
403 insufficient_scope	The key lacks the permission the tool requires
Tool error	Kibo does not allow the operation with your permissions, or a code does not exist
403 with no body	Request from a browser with an Origin other than Kibo
404 JSON	Wrong path under /mcp

A tool error comes back as a result with isError: true and a text explaining why, so the model can correct itself.

REST API

The MCP tools are built on the versioned public API /api/v1, which accepts the same keys and the same permissions. You can call it directly from a script:

curl -H "Authorization: Bearer kibo_sk_YOUR_KEY" \
  "https://app.kibowork.ai/api/v1/tasks?project=ACME&limit=20"

v1 only receives backward-compatible additions; a breaking change will arrive as /api/v2, with v1 still supported.

Security

• The credential stays in the client or the operating system: the model never sees it.
• Members, roles, billing and settings cannot be reached through MCP.
• Every call made with a key updates Last used in My account → Integrations → API keys.
• If a key is exposed, revoke it there right away.

More questions: How does the MCP connection work? · FAQ